Real-Time Classification of Encrypted Traffic Based on EfficientViT

doi:10.3778/j.issn.1002-8331.2406-0023

Abstract

Abstract: With the rapid advancement of network technology, efficient real-time classification of encrypted traffic is crucial for network management and security monitoring. Current self-supervised pre-training methods, limited by large model sizes, high computational complexity, and slow inference speeds, fail to meet the demands of edge devices. This study introduces AgileViT, a novel encrypted traffic classification method using a lightweight visual Transformer, EfficientViT. This method significantly reduces model size and optimizes computational processes. It features a cascading grouped agent attention mechanism that lessens computational complexity and enhances inference efficiency. Additionally, the integration of parallel lightweight residual blocks with inductive bias improves the learning of local traffic features, boosting adaptability and accuracy with limited training data. Experiments on the AppClassNet dataset show that AgileViT achieves 85.38% accuracy and an inference speed of 149.45 microseconds per sample, outperforming existing lightweight models in efficiency and performance, effectively addressing the challenges of real-time encrypted traffic classification on edge devices.

Key words: encrypted traffic classification, EfficientViT, self-attention mechanism, lightweight network, real-time performance optimization

摘要： 随着网络技术的快速发展，实时高效地分类加密流量已成为网络管理和安全监测的关键需求。现有自监督预训练方法面临模型规模庞大、计算复杂度高、推理速度慢以及对大量训练数据的依赖等限制，难以满足边缘设备对实时性和高效性的要求。针对这一问题，提出了一种基于轻量化视觉Transformer的加密流量实时分类新方法——AgileViT。通过采用EfficientViT框架，优化模型架构和计算流程，显著降低了模型的规模和内存需求；通过设计级联分组代理注意力机制，有效减少了模型的计算复杂度，大幅提高了模型的推理效率，同时保持了高表达能力；提出并行轻量化残差块，应用归纳偏置，增强了对加密流量局部特征的学习能力，提高了模型在有限训练数据情况下的适应性和分类准确性。实验结果表明，所提的AgileViT方法在商业级数据集AppClassNet上，以仅1.179×107可训练参数的条件下，实现了85.38%的分类准确率和每样本149.45?μs的推理速度，与现有的先进轻量化方法相比，在推理效率和分类性能上均显示出显著优势，有效解决了边缘设备上加密流量实时分类的核心挑战。

关键词: 加密流量分类, EfficientViT, 自注意力机制, 轻量化网络, 实时性能优化

YAO Lifeng, CAI Manchun, ZHU Yi, CHEN Yonghao, ZHANG Yiwen. Real-Time Classification of Encrypted Traffic Based on EfficientViT[J]. Computer Engineering and Applications, 2025, 61(18): 273-289.

姚利峰, 蔡满春, 朱懿, 陈咏豪, 张溢文. 基于EfficientViT的加密流量实时分类方法[J]. 计算机工程与应用, 2025, 61(18): 273-289.

References

[1] REZAEI S, LIU X. Deep learning for encrypted traffic classification: an overview[J]. IEEE Communications Magazine, 2019, 57(5): 76-81.
[2] VELAN P, ?ERMáK M, ?ELEDA P, et al. A survey of methods for encrypted traffic classification and analysis[J]. International Journal of Network Management, 2015, 25(5): 355-374.
[3] 陈子涵, 程光, 徐子恒, 等. 互联网加密流量检测、分类与识别研究综述[J]. 计算机学报, 2023, 46(5): 1060-1085.
CHEN Z H, CHENG G, XU Z H, et al. A survey on Internet encrypted traffic detection, classification and identification[J]. Chinese Journal of Computers, 2023, 46(5): 1060-1085.
[4] YANG B W, LIU D. Research on network traffic identification based on machine learning and deep packet inspection[C]//Proceedings of the 2019 IEEE 3rd Information Technology, Networking, Electronic and Automation Control Conference. Piscataway: IEEE, 2019: 1887-1891.
[5] ACETO G, CIUONZO D, MONTIERI A, et al. MIMETIC: mobile encrypted traffic classification using multimodal deep learning[J]. Computer Networks, 2019, 165: 106944.
[6] ACETO G, CIUONZO D, MONTIERI A, et al. Toward effective mobile encrypted traffic classification through deep learning[J]. Neurocomputing, 2020, 409: 306-315.
[7] BELIARD C, FINAMORE A, ROSSI D. Opening the deep pandora box: explainable traffic classification[C]//Proceedings of the IEEE Conference on Computer Communications Workshops. Piscataway: IEEE, 2020: 1292-1293.
[8] LIU C, HE L T, XIONG G, et al. FS-net: a flow sequence network for encrypted traffic classification[C]//Proceedings of the IEEE Conference on Computer Communications. Piscataway: IEEE, 2019: 1171-1179.
[9] LOTFOLLAHI M, JAFARI SIAVOSHANI M, SHIRALI HOSSEIN ZADE R, et al. Deep packet: a novel approach for encrypted traffic classification using deep learning[J]. Soft Computing, 2020, 24(3): 1999-2012.
[10] NASCITA A, MONTIERI A, ACETO G, et al. XAI meets mobile traffic classification: understanding and improving multimodal deep learning architectures[J]. IEEE Transactions on Network and Service Management, 2021, 18(4): 4225-4246.
[11] REZAEI S, KROENCKE B, LIU X. Large-scale mobile app identification using deep learning[J]. IEEE Access, 2019, 8: 348-362.
[12] WANG X, CHEN S H, SU J S. Automatic mobile app identification from encrypted traffic with hybrid neural networks[J]. IEEE Access, 2020, 8: 182065-182077.
[13] ACETO G, CIUONZO D, MONTIERI A, et al. Mobile encrypted traffic classification using deep learning: experimental evaluation, lessons learned, and challenges[J]. IEEE Transactions on Network and Service Management, 2019, 16(2): 445-458.
[14] YANG L X, FINAMORE A, JUN F, et al. Deep learning and zero-day traffic classification: lessons learned from a commercial-grade dataset[J]. IEEE Transactions on Network and Service Management, 2021, 18(4): 4103-4118.
[15] LIU X Y, PENG H W, ZHENG N X, et al. EfficientViT: memory efficient vision transformer with cascaded group attention[C]//Proceedings of the 2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition. Piscataway: IEEE, 2023: 14420-14430.
[16] HAN D, YE T, HAN Y, et al. Agent attention: on the integration of softmax and linear attention[J]. arXiv:2312.08874, 2023.
[17] FAUVEL K, CHEN F X, ROSSI D. A lightweight, efficient and explainable-by-design convolutional neural network for Internet traffic classification[C]//Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining. New York: ACM, 2023: 4013-4023.
[18] 侯剑, 鲁辉, 刘方爱, 等. 加密恶意流量检测及对抗综述[J]. 软件学报, 2024, 35(1): 333-355.
HOU J, LU H, LIU F A, et al. Detection and countermeasure of encrypted malicious traffic: a survey[J]. Journal of Software, 2024, 35(1): 333-355.
[19] VAN EDE T, BORTOLAMEOTTI R, CONTINELLA A, et al. FlowPrint: semi-supervised mobile-app fingerprinting on encrypted network traffic[C]//Proceedings 2020 Network and Distributed System Security Symposium, 2020.
[20] ESTE A, GRINGOLI F, SALGARELLI L. Support vector machines for TCP traffic classification[J]. Computer Networks, 2009, 53(14): 2476-2490.
[21] SUN G L, CHEN T, SU Y Y, et al. Internet traffic classification based on incremental support vector machines[J]. Mobile Networks and Applications, 2018, 23(4): 789-796.
[22] ALSHAMMARI R, ZINCIR-HEYWOOD A N. Can encrypted traffic be identified without port numbers, IP addresses and payload inspection?[J]. Computer Networks, 2011, 55(6): 1326-1350.
[23] DIAS K L, ALMEIDA PONGELUPE M, CAMINHAS W M, et al. An innovative approach for real-time network traffic classification[J]. Computer Networks, 2019, 158: 143-157.
[24] WANG W, ZHU M, ZENG X W, et al. Malware traffic classification using convolutional neural network for representation learning[C]//Proceedings of the 2017 International Conference on Information Networking. Piscataway: IEEE, 2017: 712-717.
[25] REN X M, GU H X, WEI W T. Tree-RNN: tree structural recurrent neural network for network traffic classification[J]. Expert Systems with Applications, 2021, 167: 114363.
[26] LAN J H, LIU X D, LI B, et al. DarknetSec: a novel self-attentive deep learning method for darknet traffic classification and application identification[J]. Computers & Security, 2022, 116: 102663.
[27] 冯景瑜, 王锦康, 张宝军, 等. 基于信任过滤的轻量级加密流量异常检测方案[J]. 西安邮电大学学报, 2023, 28(5): 56-66.
FENG J Y, WANG J K, ZHANG B J, et al. Anomaly detection scheme of lightweight encrypted traffic based on trust filtering[J]. Journal of Xi’an University of Posts and Telecommunications, 2023, 28(5): 56-66.
[28] 杨忠富, 常俊, 许妍, 等. 联合胶囊和双向LSTM网络的VPN加密流量识别[J]. 计算机工程与应用, 2023, 59(23): 246-253.
YANG Z F, CHANG J, XU Y, et al. VPN encrypted traffic identification for joint capsule and bidirectional LSTM networks[J]. Computer Engineering and Applications, 2023, 59(23): 246-253.
[29] 赵阳阳. 物联网加密流量多层次识别方法研究[D]. 北京: 北京交通大学, 2023.
ZHAO Y Y. Research on multi-level identification method of encrypted traffic in Internet of Things[D]. Beijing: Beijing Jiaotong University, 2023.
[30] 牟乔旭. 基于混合压缩和生成对抗网络的加密流量分类研究[D]. 长春: 吉林大学, 2023.
MOU Q X. Research on encrypted traffic based on hybrid compression and generative adversarial networks[D]. Changchun: Jilin University, 2023.
[31] 赵广龙. 基于深度学习的轻量化网络流量分类方法研究[D]. 哈尔滨: 黑龙江大学, 2023.
ZHAO G L. Research on lightweight network traffic classification method based on deep learning[D]. Harbin: Heilongjiang University, 2023.
[32] VASWANI A, SHAZEER N, PARMAR N, et al. Attention is all you need[C]//Advances in Neural Information Processing Systems, 2017.
[33] MA N N, ZHANG X Y, ZHENG H T, et al. ShuffleNet V2: practical guidelines for efficient CNN architecture design[C]//Proceedings of the European Conference on Computer Vision. Cham: Springer, 2018: 122-138.
[34] HAN K, WANG Y H, TIAN Q, et al. GhostNet: more features from cheap operations[C]//Proceedings of the 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition. Piscataway: IEEE, 2020: 1577-1586.
[35] WANG C, FINAMORE A, YANG L X, et al. AppClassNet: a commercial-grade dataset for application identification research[J]. ACM SIGCOMM Computer Communication Review, 2022, 52(3): 19-27.
[36] ACETO G, CIUONZO D, MONTIERI A, et al. MIRAGE: mobile-app traffic capture and ground-truth creation[C]//Proceedings of the 2019 4th International Conference on Computing, Communications and Security. Piscataway: IEEE, 2019: 1-8.
[37] LUXEMBURK J, ?EJKA T. Fine-grained TLS services classification with reject option[J]. Computer Networks, 2023, 220: 109467.
[38] KRIZHEVSKY A, SUTSKEVER I, HINTON G E. ImageNet classification with deep convolutional neural networks[J]. Communications of the ACM, 2017, 60(6): 84-90.
[39] HE K M, ZHANG X Y, REN S Q, et al. Deep residual learning for image recognition[C]//Proceedings of the 2016 IEEE Conference on Computer Vision and Pattern Recognition. Piscataway: IEEE, 2016: 770-778.
[40] HUANG G, LIU Z, VAN DER MAATEN L, et al. Densely connected convolutional networks[C]//Proceedings of the 2017 IEEE Conference on Computer Vision and Pattern Recognition. Piscataway: IEEE, 2017: 2261-2269.
[41] WOO S, DEBNATH S, HU R H, et al. ConvNeXtV2: co-designing and scaling ConvNets with masked autoencoders[C]//Proceedings of the 2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition. Piscataway: IEEE, 2023: 16133-16142.
[42] TAN M X, LE Q V. EfficientNetV2: smaller models and faster training[C]//Proceedings of the International Conference on Machine Learning, 2021.
[43] HOWARD A, SANDLER M, CHEN B, et al. Searching for MobileNetV3[C]//Proceedings of the 2019 IEEE/CVF International Conference on Computer Vision. Piscataway: IEEE, 2019: 1314-1324.
[44] WANG A, CHEN H, LIN Z J, et al. Rep ViT: revisiting mobile CNN from ViT perspective[C]//Proceedings of the 2024 IEEE/CVF Conference on Computer Vision and Pattern Recognition. Piscataway: IEEE, 2024: 15909-15920.